Menu
Community /Pin to ProfileBookmark2. 3. 
@NogDogMar 17.2010 — #When you [i]hash[/i] the password with something like sha1() (or the older and slightly less secure md5()) as opposed to [i]encrypting[/i] it, the hashed value is much harder to reverse, as hashing is considered to be "one-way encryption". The only way to decrypt a hashed string is via brute force trial-and-error and/or via a dictionary look-up of hashed words. Therefore, if you hash the passwords, if someone gets access to your DB in any manner, it is more of a challenge to discover actual passwords. If the person with the data has also gotten hold of your code and can figure out what "salt" you've used with your hash, they could in theory then use a brute-force process to guess passwords in the DB, but even that become quite difficult if you enforce a strong password policy (you know: at least on each of upper-case letter, lower-case letter, number, special character, etc....)
As with most things with security, the objective is to put numerous layers of security that a potential cracker must get by. In and of itself, hashing passwords is not a complete security solution, but as one of several layers in your security "onion" it is quite useful.
PS: I would strongly recommend reading [i]Essential PHP Security[/i] by Chris Shiflett (it's a pretty short book).
[RESOLVED] Password security confusion
Hi. Having read many different things about security, I am now completely confused. The bane of learning…lmao.
(btw – kinda an sql question too…but think here is more appropriate ? )
As far as I understand
1.
You can put your mysql host/username/password/user information in a PHP script as it is not possible for a user to see this information. [URL=”http://www.webdeveloper.com/forum/showthread.php?t=226195″]http://www.webdeveloper.com/forum/showthread.php?t=226195
It then stands to reason that information sought from the database via PHP is also safe from hackers.
If I am using PHP to check a users password against one stored in the database, i should be using MD5/SERIALIZE()/TLS/SSL/SHA1/.htaccess/etc etc…….
Surely if I need one/all these, then my original database access info is also at risk and the hacker could get all the db info anyway??
Am sure I am missing something, but have read to much now to know what.
Sign in
to post a comment6 Comments(s) ↴
0
@NogDogMar 17.2010 — #When you [i]hash[/i] the password with something like sha1() (or the older and slightly less secure md5()) as opposed to [i]encrypting[/i] it, the hashed value is much harder to reverse, as hashing is considered to be "one-way encryption". The only way to decrypt a hashed string is via brute force trial-and-error and/or via a dictionary look-up of hashed words. Therefore, if you hash the passwords, if someone gets access to your DB in any manner, it is more of a challenge to discover actual passwords. If the person with the data has also gotten hold of your code and can figure out what "salt" you've used with your hash, they could in theory then use a brute-force process to guess passwords in the DB, but even that become quite difficult if you enforce a strong password policy (you know: at least on each of upper-case letter, lower-case letter, number, special character, etc....)As with most things with security, the objective is to put numerous layers of security that a potential cracker must get by. In and of itself, hashing passwords is not a complete security solution, but as one of several layers in your security "onion" it is quite useful.
PS: I would strongly recommend reading [i]Essential PHP Security[/i] by Chris Shiflett (it's a pretty short book).